NAT Gateway:Connect a data center and VPC with a VPC NAT gateway and Express Connect

Step 1: Create VPC and VBR connections

Create a VBR connection and a VPC connection on the Transit Router to establish private communication between your on-premises data center and the VPC.

1. Log on to the Cloud Enterprise Network console.

2. On the CEN Instance page, click the ID of the target CEN instance.

3. On the Basic Settings > Transit Router tab, find the target Transit Router instance and click Create Connection in the Actions column.

   If this is the first time you perform this operation, the system automatically creates a service-linked role named AliyunServiceRoleForCEN. This role allows the Transit Router to create an elastic network interface (ENI) on a vSwitch in the VPC.

   • Network Type: Select VPC.

   • Region: Select the region where the VPC is deployed.

   • Account: Select the account type to which the VPC belongs.

   • Billing Method: The default value is Pay-As-You-Go. For more information, see Billing.

   • Networks: Select the VPC that you want to connect.

   • vSwitch: Select at least two vSwitches in zones supported by the Transit Router.

   • Advanced Settings: Keep the default settings and select the three advanced options.

4. On the Connection with Peer Network Instance page, click Create More Connections. Configure the following parameters to create a VBR connection, and then click OK.

   • Network Type: Select Virtual Border Router (VBR).

   • Region: Select the region where the VBR is deployed.

   • Account: Select the account type to which the VBR belongs.

   • Networks: Select the VBR that you want to connect.

   • Advanced Settings: Keep the default settings and select the three advanced options.

5. After the connections are created, you can view the VPC and VBR connections on the Intra-Region Connections tab.

Step 2: Configure VBR route

Add a route to the VBR that points to the on-premises data center.

1. Go to the Virtual Border Router (VBR) page in the Express Connect console. In the top navigation bar, select the target region.

2. On the Routes tab, click Add Route Entry.

   • Next Hop Type: Select the type of the next hop. In this example, select Physical Connection.

   • Destination CIDR Block: Enter the IP address of the server in the on-premises data center: 172.16.10.137.

   • Next Hop: Select the physical connection interface to which the traffic is routed.

Step 3: Create a VPC NAT gateway

1. Go to the Create VPC NAT Gateway page.

   • Region: Select the region where you want to create the VPC NAT gateway. In this example, select China (Shanghai).

   • Network and Zone: Select the VPC and vSwitch for the VPC NAT gateway. You cannot change these settings after the instance is created.

2. On the Confirm page, confirm the parameters, agree to the terms of service, and then click Activate Now.

Step 4: Add a system route for VPC1

Make sure that the vSwitches of the ECS instances in VPC1 are associated with the system route table. If a vSwitch is associated with a custom route table, add the route entry to that custom route table.

1. Log on to the VPC console.

2. Go to the VPCs page. In the top navigation bar, select the target region.

3. Click the ID of the target VPC to open its details page. On the Resource Management tab, click the link under Route Tables.

4. Click the ID of the route table for which the Route Table Type is System. On the Custom Route tab, click Add Route Entry.

   • Destination CIDR Block: Enter the destination CIDR block to which traffic is forwarded. Enter the IP address of the server in the on-premises data center: 172.16.10.137.

   • Next Hop Type: Select NAT Gateway.

   • NAT Gateway: Select the VPC NAT gateway that you created.

Step 5: Create and configure a custom route table

1. Go to the Route Tables page of the VPC console. In the top navigation bar, select the target region.

2. Click Create Route Table.

   • VPC: Select the VPC to which the route table belongs. In this example, select VPC1.

   • Associated Resource Type: Select vSwitch.

3. Find the route table, click Bind in the Associated Resource column, and then click Associate vSwitch. Select the vSwitch to which the VPC NAT gateway belongs.

4. On the Route Entry List > Custom Route tab, click Add Route Entry.

   • Destination CIDR Block: Enter the destination CIDR block to which traffic is forwarded. Enter the IP address of the server in the on-premises data center: 172.16.10.137.

   • Next Hop Type: Select Transit Router.

   • Transit Router: Select the VPC connection that is attached to the Transit Router.

Step 6: Create SNAT and DNAT entries

• Create an SNAT entry to allow ECS instances in the VPC to access the on-premises data center.

• Create a DNAT entry to allow the on-premises data center to access ECS instances in the VPC.

1. Go to the VPC NAT Gateway page in the NAT Gateway console. In the top navigation bar, select the target region.

2. Find the target VPC NAT gateway, click SNAT in the Actions column, and then click Create SNAT Entry.

   • SNAT Entry: Select Specify vSwitch. From the Select vSwitch list, select the vSwitch where the ECS instance is located.

   • Select NAT IP Address: Select the NAT IP address used to access external private networks. Select the default NAT IP address.

3. On the DNAT tab, click Create DNAT Entry.

   • Select NAT IP Address: Select the NAT IP address used to receive requests from external private networks. In this example, select the default NAT IP address.

   • Select Private IP Address: Select the destination private IP address. You can Select by ECS or ENI to choose the private IP address of ECS1, or you can enter it manually.

   • Port Settings: Select the DNAT mapping method. In this example, select Specific Port. Set Frontend Port to 22, Backend Port to 22, and Protocol to TCP.

Step 7: Configure the on-premises IDC route

ip route 192.168.0.0 255.255.0.0 10.0.0.2

Step 8: Test connectivity

1. Log on to ECS1, which is in VSW1.

2. Run theping <IP address of the server in the on-premises data center> command to test whether ECS1 can access the server. If you receive reply packets, the connection is established.

3. Log on to the server in your on-premises data center and run thessh root@<NAT_IP> command, where is the default NAT IP address of the VPC NAT gateway. Then, enter the logon password for ECS1. A successful login confirms that the server in the on-premises data center can connect to ECS1.